[nsp-sec] DDoS against www.gva.es

[Carles Fragoso]

Thanks a lot for your feedback Yonglin and also to Jose Nazario and Arbor guys! You r0ck! :)

We where tracking main related Twitter profiles and IRC channels and it seems that Anonymous "Global" didn't gave a full support to this attack.

GVA.es<http://GVA.es> guys where able to do some signatures on IPS and perform realtime blacklisting to contain the problem.

Let's see how all these local ciberactivism goes to, specially those who use the Anonymous hat (or mask, hehe) to justify their actions.

-- Carlos Fragoso (CESICAT-CERT)

On Feb 21, 2011, at 6:29 AM, Yonglin ZHOU wrote:

Carles,

We did not see any big traffic to it from Chinese networks around the time.
FYI.

Yonglin.
CNCERT/CC

On Fri, Feb 18, 2011 at 10:06 PM, Carles Fragoso <cfragoso at cesicat.cat<mailto:cfragoso at cesicat.cat>> wrote:
----------- nsp-security Confidential --------

Guys,

"Local Anonymous Chapters" have started DDoSing (official is planned at 19.00GMT+1) the webpage of Generalitat de Valencia Government in Spain (www.gva.es<http://www.gva.es/><http://www.gva.es/>), because they have recently censored TV3 TV catalan channel broadcast in Valencia (http://en.wikipedia.org/wiki/Països_Catalans<http://en.wikipedia.org/wiki/Pa%C3%AFsos_Catalans><http://en.wikipedia.org/wiki/Pa%C3%AFsos_Catalans>):

http://pastehtml.com/view/1da4saf.html

Although they have warned all their upstream providers and related CERT teams, it would be great if any of you could track activity outside spain directed to their IPs to share them afterwards, because probably other Anonymous hacktivist could follow this call:

Name:   simac13.gva.es<http://simac13.gva.es/><http://simac13.gva.es/>
Address: 193.144.127.85
Name:   simac13.gva.es<http://simac13.gva.es/><http://simac13.gva.es/>
Address: 195.77.16.26

Thanks!

-- Carlos Fragoso (CESICAT-CERT)


_______________________________________________
nsp-security mailing list
nsp-security at puck.nether.net<mailto:nsp-security at puck.nether.net>
https://puck.nether.net/mailman/listinfo/nsp-security

Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
community. Confidentiality is essential for effective Internet security counter-measures.
_______________________________________________



--
----------------- Enjoy the life --------------------
Yonglin ZHOU
Fix line: + 86 10 8299 0355  Fax: +86 10 8299 0399
Email: zyl at cert.org.cn<mailto:zyl at cert.org.cn>,  yonglin.zhou at gmail.com<mailto:yonglin.zhou at gmail.com>
-------------------------------------------------------------------------